feat: 账套模式后端 — token绑定entity_id + user_entities授权表 + 解析链倒置

- auth_middleware: create_token存JSON{user_id,entity_id}，旧int格式token强制下线
- models: 新增UserEntity授权表(user_id↔entity_id多对多,唯一约束)
- database: init_db自动建表+存量用户×active企业默认授权(平滑迁移)
- deps: get_entity_id解析链倒置 token优先 → Bot白名单(query/header校验entity active) → 默认1
- auth: login加entity_id+授权校验; 新增switch-entity/my-entities/登录页entities接口; register自动授权

backend/app/database.py

@@ -68,6 +68,35 @@ def init_db():
     except Exception as e:
         logger.warning(f"组织数据初始化跳过: {e}")
 
+    # ── user_entities 授权表初始化（账套模式平滑迁移）──
+    # 首次建表（表空）时，给存量用户默认授权所有 active 企业，保证现有登录不丢权限
+    try:
+        inspector = inspect(get_engine())
+        if "user_entities" in inspector.get_table_names():
+            Session = get_session_local()
+            session = Session()
+            try:
+                from app.models import UserEntity, User, Entity
+                cnt = session.query(UserEntity).count()
+                if cnt == 0:
+                    users = session.query(User).all()
+                    entities = session.query(Entity).filter(Entity.status == "active").all()
+                    if users and entities:
+                        for u in users:
+                            for e in entities:
+                                exists = session.query(UserEntity).filter(
+                                    UserEntity.user_id == u.id,
+                                    UserEntity.entity_id == e.id,
+                                ).first()
+                                if not exists:
+                                    session.add(UserEntity(user_id=u.id, entity_id=e.id, granted_by=None))
+                        session.commit()
+                        logger.info(f"user_entities初始化: {len(users)}用户 × {len(entities)}企业")
+            finally:
+                session.close()
+    except Exception as e:
+        logger.warning(f"user_entities初始化跳过: {e}")
+
 
 def _seed_org_data(db_session):
     """插入5层级组织示例数据"""